Post

Andrew Lilley Brinker
@alilleybrinker.com

Good news in vuln management world: CNAs of Last Resort issue less than 5% of all vulnerabilities now. That’s a win for the quality of CVE records. No org is equipped to do high-context vuln-report assessments from security researchers across *all* software or hardware.

Andrew Lilley Brinker@alilleybrinker.com

Got curious and had Claude whip these up from the cvelistv5 repo.

Andrew Lilley Brinker
@alilleybrinker.com

There’s a weird ecosystem of vuln management greybeards who spend a lot of time fixated on the quality of CNA-LR CVE records, while missing how the importance of those has been dropping. The CVE program recognized 10 years ago that they needed federation to scale, so they made it happen.

0 reposts0 likes

Andrew Lilley Brinker
@alilleybrinker.com

We’re in a similar situation today with vulnerability “enrichment,” with NVD and independent downstreams unable to keep up. CVE’s adopted a federated strategy with Authorized Data Publishers and by moving more expectations onto CNAs directly. IMO this is right and I hope they expand ADP enrollment.